{"id":"CVE-2026-82120","kind":"vulnerability","aliases":["CVE-2026-82120"],"related":[],"title":"HiRDB: heap buffer overflow in server lets attackers run code","description":"Heap-based Buffer Overflow Vulnerability in HiRDB.\n\n\nThis issue affects HiRDB Server Version 10: from 10-00 before 10-12-01; HiRDB Server Version 9: from 09-00 through 09-66-22; HiRDB Server with Additional Function Version 9: from 09-00 through 09-66/V; HiRDB Server Version 9(32): from 09-02 through 09-66-22; HiRDB Server with Additional Function Version 9(32): from 09-00 through 09-66-/V.","summary":"HiRDB is a database server from Hitachi. A heap-based buffer overflow in the server lets an attacker overwrite memory, which can lead to code execution on the database host.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["database","hirdb","hitachi","package","self-hosted"],"not_affected_if":["not-running-hirdb"],"how_to_check":"- Check the installed HiRDB Server version against the affected ranges: Version 10 before `10-12-01`, and Version 9 from `09-00` through `09-66-22` (including the 9(32) and Additional Function variants).","fix":"- Upgrade HiRDB Server to `10-12-01` or later for Version 10, or move to a fixed release of the 9.x line as published by the vendor (fixed version for 9.x not stated in the sources).","status":"open","published_at":"2026-10-27T10:16:56+00:00","first_seen_at":"2026-10-27T10:31:02+00:00","triaged_at":"2026-10-27T10:31:33+00:00","updated_at":"2026-10-27T10:31:33+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-27T10:31:33Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade HiRDB Server to `10-12-01` or later for Version 10, or move to a fixed release of the 9.x line as published by the vendor (fixed version for 9.x not stated in the sources).","reach":"unknown","title":"HiRDB: heap buffer overflow in server lets attackers run code","impact":"high","summary":"HiRDB is a database server from Hitachi. A heap-based buffer overflow in the server lets an attacker overwrite memory, which can lead to code execution on the database host.","category":"package","nicknames":[],"who_cares":["hirdb","database","hitachi","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker may run code on the database server","analyst_note":"Check the NVD entry and Hitachi's advisory for the fixed 9.x version, the triggering network path, and whether authentication is required.","how_to_check":"- Check the installed HiRDB Server version against the affected ranges: Version 10 before `10-12-01`, and Version 9 from `09-00` through `09-66-22` (including the 9(32) and Additional Function variants).","needs_analyst":true,"not_affected_if":["not-running-hirdb"],"who_is_affected":"Organizations running HiRDB Server in the listed version ranges, including the Additional Function and 9(32) variants. The sources do not say what configuration or network exposure is required to reach the overflow, so unknown whether a default install is reachable. Teams not running HiRDB can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000616,"input_tokens":3384,"output_tokens":555,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-00':72C,83C,97C,124C '-01':76C '-02':109C '-12':75C '-2026':12A,15A '-22':87C,113C '-66':86C,100C,112C,127C '-82120':13A,16A '/v':101C,128C '09':82C,85C,96C,99C,108C,111C,123C,126C '10':69C,71C,74C '32':106C,121C '9':80C,94C,105C,120C 'addit':91C,117C 'affect':65C 'attack':8A,42B 'base':34B,57C 'buffer':3A,35B,58C 'code':10A,49B 'cve':11A,14A 'databas':17B,27B,53B 'execut':50B 'function':92C,118C 'heap':2A,33B,56C 'heap-bas':32B,55C 'hirdb':1A,18B,24B,62C,66C,77C,88C,102C,114C 'hitachi':19B,30B 'host':23B,54B 'issu':64C 'lead':47B 'let':7A,40B 'memori':44B 'overflow':4A,36B,59C 'overwrit':43B 'packag':20B 'run':9A 'self':22B 'self-host':21B 'server':6A,28B,39B,67C,78C,89C,103C,115C 'version':68C,79C,93C,104C,119C 'vulner':60C","nicknames":[],"mitigations":[],"who_affected":"Organizations running HiRDB Server in the listed version ranges, including the Additional Function and 9(32) variants. The sources do not say what configuration or network exposure is required to reach the overflow, so unknown whether a default install is reachable. Teams not running HiRDB can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T10:16:56+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"hirt@hitachi.co.jp","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-82120","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-82120","severity":null,"published_at":"2026-10-27T10:16:56+00:00","modified_at":"2026-10-27T10:16:56+00:00","first_seen_at":"2026-10-27T10:31:02+00:00","fetched_at":"2026-10-27T10:31:02+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}